This advisory covers several security vulnerabilities in Mozilla Thunderbird, as maintained by Red Hat for Red Hat Enterprise Linux 8.2. The issues include memory safety bugs (CVE-2025-11714, CVE-2025-11715), out-of-bounds read/write triggered by WebGL textures in a privileged process (CVE-2025-11709), cross-process information leakage via malicious IPC messages (CVE-2025-11710), a use-after-free vulnerability in MediaTrackGraphImpl::GetInstance() (CVE-2025-11708), an OBJECT tag type attribute overriding browser behavior without a content-type (CVE-2025-11712), and modification of some non-writable object properties (CVE-2025-11711). These vulnerabilities have been fixed in Thunderbird ESR 140.4 and Thunderbird 144. The Red Hat advisory classifies the update as important and rates the security impact as high.

The vulnerabilities collectively impact memory safety, process isolation, and object property integrity within Thunderbird, potentially allowing memory corruption, information leakage, and unauthorized modification of object properties. These issues could lead to application crashes or other unintended behavior. The advisory does not report known exploits in the wild. The overall security impact is rated as high by Red Hat.

Red Hat has released an updated Thunderbird package (version 140.4.0-2.el8_2) for Red Hat Enterprise Linux 8.2 that addresses these vulnerabilities. Users should apply this official update to remediate the issues. For detailed update instructions, refer to the Red Hat article at https://access.redhat.com/articles/11258. No additional mitigations are specified or required beyond applying the update.